MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf
SHA3-384 hash: 9ce53a21d6201f29b9639934458df17c8552f1600450df9d92eb29ce94badd83d71bf2b727603f49612bdd69fad70cdb
SHA1 hash: 435ca090ea1bd2e1bd23773cd575e88078f1ce77
MD5 hash: 1646b723d5926d6392547d7c7f4ea3a8
humanhash: victor-william-yankee-blue
File name:Product List.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:30'570 bytes
First seen:2021-04-08 06:53:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:9K6oV8H6QwYVZXo0oatzv2LgT9hYdcY5yf2igYG1jIsdZm:9YV8HfFZoAz2gT9en79jLdZm
TLSH DCD2E1EF66E0777894B6CB015F9033299596E0DAE3DAE4045811EA3CE9504B1379F4FC
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: thegambit.ro
Sending IP: 91.216.156.17
From: Martin Václavek <info@psicoalcala.es>
Reply-To: me <testing@mkontakt.az>
Subject: ORDER REQUEST (RFQ#798606)
Attachment: Product List.zip (contains "Product List.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_us63.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22754.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 06:54:10 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybldbuyc5n5qupsjf4nkexbcno4kedns73bsiqgvhtiyxjnzpdhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip c05630d302eb7b0a3e492f1aa25c226bb8a20db2fec32440d53cd18ba5b978cf

(this sample)

QuasarRAT

Executable exe 254f4133d2bfa7ca67fdc4704022cd1c22fb1e22957c90a29626ed8f2d189a3a

  
Dropping
MD5 e206bbb108e3a2e7a554897f9f4d489c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 254f4133d2bfa7ca67fdc4704022cd1c22fb1e22957c90a29626ed8f2d189a3a

Comments